The Hyflock ransomware group has posted a database on its leak site that it says belongs to Cameroon's government troops. The group claims the database holds more than 6 million records, including about 1.35 million historical personnel files, about 2.41 million operational audit records and almost 1 million system activity logs. Breach trackers DeXpose and Cyber Threat Intelligence link the listing to mindef.gov.cm, the domain of Cameroon's Ministry of Defence. Cameroon's government has not confirmed an incident, and no independent researcher has publicly verified samples of the data. Every record count in this brief comes from the attackers' own description of what they took.
What Happened
On 9 November 2026, Hyflock added a listing titled "Cameroon government troops leaked" to its leak site. The threat intelligence account DailyDarkWeb flagged the listing first. RansomLook and several breach-monitoring services picked it up later that day. HookPhish logged the listing at 16:52 UTC.
Early reports describe the listing differently. HIFY Radar and Undercode News, both relying on DailyDarkWeb's post, say the listing gave no record count, data fields or named agency. It only claimed that the group had "analyzed an entire database" tied to Cameroon's government forces. DeXpose, Cyber Threat Intelligence and HookPhish all reproduce a much longer statement from the group, with record counts for each table. QPulse also published those counts on 10 November. The likeliest explanation is that the detailed statement appeared after the first headline or on a separate page, but no one has confirmed this. Either way, the figures are Hyflock's own claims.
Cameroonian authorities have not responded publicly. No national CERT advisory or official statement has been published.
What Was Taken
Hyflock describes the dump as "a massive database containing over 6 million records," broken down by table name. The French table names fit a Cameroonian government system, since French is one of Cameroon's two official languages. The figures below are the group's own:
- HISTO_RECIP (1,349,243 records): historical personnel files that the group says include birth and death records, career histories and background information.
- HISTO_OR (about 2.41 million records): core operational audit and history records.
- TMOUCHARD (999,037 records): system activity audit logs. "Mouchard" is French for an informant or monitor. According to the group, these logs track user activity and security events.
- RECIPIENDAIRE (160,920 records) and DISTINCTION (161,481 records): the group calls these the current roster of military and political personnel who have received honours or awards.
- FGRADE_ARME (6,542 records): mappings between military ranks and branches.
- TRANSMIS_MEMOIRES and HISTO_MEMOIRE: QPulse reports more than 500,000 memoranda and internal communication records in these tables.
The table names suggest the database may manage military honours, careers and personnel administration, not a full defence records system. Nobody outside the group has confirmed this. The named tables add up to somewhat less than 6 million records, which suggests other tables are in the dump that the group did not list. QPulse's summary also lists France as the "geographic impact." No other report supports that, and the data described is Cameroonian.
Why It Matters
If the data is genuine, the danger to people comes before any IT problem. Combining personnel histories, honours lists and rank tables would let someone build a fairly detailed picture of Cameroon's senior officers and their careers. The group itself says the rank data could be used to find "high-value targets such as generals and senior special forces officers." Cameroon's armed forces are fighting a separatist conflict in the Anglophone regions and an insurgency in the Far North. Identifying details about serving personnel and their families could be useful to hostile armed groups as well as to criminals.
The audit log claim matters most to defenders. QPulse argues that nearly a million activity logs show administrators' routines, login times and most-used assets. An attacker could use that to hide persistence or erase specific log entries without being noticed. This is QPulse's interpretation and the group's framing, not a forensic finding. Still, the risk is real: stolen logs show how a network is watched, and any defender responding to this incident should assume the attacker knows when and how the logs are reviewed.
The listing also shows Hyflock moving quickly. Check Point Research reports that the group began naming victims publicly in October 2026, including eight claims on 13 October alone. Cyber Threat Intelligence now counts 14 victims listed by Hyflock. A ministry of defence would be one of its most prominent targets so far.
The Attack Technique
Nobody has reported how Hyflock got into the Cameroonian system. The listing gives no access vector, timeline or exfiltration method, and there is no confirmation that ransomware was actually deployed on government systems. The listing may be a data-theft and extortion operation only.
Check Point's analysis, published on 4 November, gives the most reliable picture of what the group can do:
- Hyflock first appeared on underground forums in March 2026, advertising a ransomware-as-a-service platform. It recruited affiliates by promoting encryption speed and access procurement.
- Researchers followed four generations of the ransomware between April and October 2026. The October builds changed how the malware launches, runs in the background and interacts with network resources.
- Confirmed capabilities include file encryption, persistence through scheduled tasks, activity on network shares, and attempts to interfere with system recovery.
- Some advertised features remain unverified, including domain-wide spread and reliable execution after a remote desktop session ends.
- Weaknesses in the encryption let researchers recover 73 internal components from seven encrypted Office files without the key. Some Hyflock victims may be able to recover files without paying.
Hyflock runs as an affiliate model and advertises access procurement. That means the initial intrusion may have come from an affiliate or a bought access broker foothold, not from Hyflock's core operators.
What Organizations Should Do
- Treat audit infrastructure as compromised, not just the data. Any organisation responding to a suspected Hyflock intrusion should assume its logging routines are known to the attacker. Send logs to a separate, append-only store that ordinary administrator accounts cannot change, and look for gaps or deletions in log history.
- Hunt for Hyflock's confirmed persistence and recovery tampering. Review recently created scheduled tasks, unusual access to network shares, and any deletion of shadow copies or backup catalogues. Check Point has confirmed these behaviours in recent builds.
- Lock down remote access paths. The group advertises bought access and remote desktop abuse. Require phishing-resistant MFA on VPN and RDP, remove internet-facing RDP, and rotate credentials for privileged and service accounts.
- Protect personnel databases as sensitive security assets. Defence and government HR, honours and career systems should get the same network segmentation and access monitoring as operational systems. Exporting a whole database table by table should trigger an alert.
- Keep encrypted files before paying. Check Point's research shows Hyflock's encryption has flaws. Victims should preserve encrypted data and talk to incident responders about recovery before considering payment.
- Prepare to protect the people in the data. If the leak is confirmed, Cameroonian authorities should warn affected personnel and their families about targeted phishing, impersonation and physical security risks. They should also make clear that nobody should download or share the alleged data.
Sources: Hyflock Ransomware Group Leaks Over 6 Million Records from Cameroon... | HYFLOCK Ransomware Evolution and Encryption Weaknesses | HYFLOCK Breaches Cameroon Government Troops - DeXpose | Hyflock Claims Leak of Cameroon Government… HIFY Radar | Hyflock claims Cameroon government troops leak Vulnpocalypse | Cameroon government troops leaked Ransomware Attack by Hyflock (202... | Hyflock Ransomware Claims Leak of Cameroon Government Troops Databa... | Cameroon government troops leaked Data Breach: Hyflock Ransomware C...